Integer Overflow and Heap Buffer Overflow in libsixel by Saitoha

CVE-2026-33020

What is CVE-2026-33020?

The libsixel library, utilized for encoding and decoding SIXEL images, contains a vulnerability due to an integer overflow that occurs during the image conversion process. Specifically, in the function sixel_frame_convert_to_rgb888(), image allocations for palettised formats (PAL1, PAL2, PAL4) rely on integer arithmetic for size calculations. When the pixel count of images exceeds certain limits, this can lead to an incorrectly sized buffer allocation and a subsequent negative pointer offset. An attacker can exploit this vulnerability by providing a specially crafted large palettised PNG image, which may result in heap corruption and a potential crash of the victim’s process. This flaw could enable remote exploitation, allowing attackers to execute arbitrary code, thereby compromising the affected system.

References